CVE-2026-15691 is a stack-based buffer overflow vulnerability affecting Tenda BE12 Pro version 16.03.66.23. The issue arises from improper handling of the page argument in the fromSafeClientFilter function of the /goform/SafeClientFilter endpoint. An attacker can remotely exploit this flaw to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Although a public exploit exists, no official patch or remediation has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability can allow a remote attacker to cause a stack-based buffer overflow on the affected device, potentially leading to arbitrary code execution or device compromise. Given the remote attack vector and lack of required privileges or user interaction, the impact is significant for affected devices running the specified firmware version.

No official patch or remediation has been published by the vendor for this vulnerability. Users should monitor the vendor's advisories for updates and consider applying any future firmware updates that address this issue. Until a fix is available, restricting remote access to the affected device's management interface may reduce exposure.